If on 14.1-73.41, the SAML SP is safe, just the IdP issue

it says clearly service provider (SP)

My understanding is that this update replaces 73.41 as a "more complete" patch of the vulnerability, protecting both IDP and SP, where as 73.41 only protected the more commonly used SP only, side of SAML config.